HIPAA Technology & Security FAQ

Yes. Cloud storage may be used under HIPAA when appropriate technical, administrative, and physical safeguards are implemented to protect protected health information. Your cloud vendor must sign a Business Associate Agreement (BAA) before storing any ePHI.

A standard Gmail account is not automatically HIPAA compliant. Certain Google Workspace plans may support HIPAA compliance when properly configured and accompanied by the appropriate agreements. See our BAA FAQ for details on which vendors require a Business Associate Agreement.

Microsoft Outlook can be used in a HIPAA-compliant manner when appropriate safeguards are implemented to protect electronic protected health information both at rest and in transit.

Organizations should not assume standard SMS messaging is appropriate for transmitting protected health information. Specialized solutions exist that are designed to support HIPAA-compliant messaging workflows.

Protected health information may be transmitted through email when appropriate safeguards, such as encryption, are implemented.

Yes. Remote work is permissible provided the organization continues to protect its administrative, physical, and technical safeguards. Organizations should address remote work scenarios in their HIPAA policies and ensure staff complete HIPAA training that covers remote work procedures.

In some circumstances, yes. Organizations should consider encryption, access controls, physical security, remote wipe capabilities, and workforce policies before allowing protected health information to be accessed on home devices. A Security Risk Assessment helps identify these risks and determine what controls are needed.

Failing to encrypt systems, devices, and information whenever practical. Encryption gaps are one of the most common findings in a HIPAA Gap Analysis.

Encryption remains one of the most overlooked and underutilized safeguards available to healthcare organizations.

Organizations should focus on technologies that improve visibility, security, and incident awareness. Even simple solutions that notify staff of unexpected activity can provide meaningful operational benefits when used appropriately.